The CMMC rules at a glance
- 32 CFR Part 170 establishes the CMMC Program. It was published as a final rule on October 15, 2024 and took effect December 16, 2024.
- The DFARS rule (48 CFR) puts CMMC requirements into DoD contracts through DFARS 252.204-7021. It was published September 10, 2025 and took effect November 10, 2025, which started the phased rollout.
The four phases
Phase 1
Level 1 and Level 2 self-assessment requirements begin appearing in applicable solicitations and contracts.
Phase 2
Level 2 certification assessments by a C3PAO begin appearing as a requirement in applicable solicitations.
Phase 3
Level 3 certification requirements, assessed by DCMA DIBCAC, begin appearing for applicable programs.
Phase 4
Full implementation: CMMC requirements are included in all applicable solicitations and contracts.
DoD may include a higher requirement earlier than its phase at its discretion, so don't plan around the latest possible date.
What Phase 2 means for CUI contractors
Through Phase 1, many contracts involving CUI could be satisfied with a Level 2 self-assessment entered in SPRS. In Phase 2, contracts that require a Level 2 certification mean you'll need a C3PAO to assess you and issue a certificate before award, or as a condition of option periods, depending on how the requirement is written.
A certification assessment reviews evidence for all 110 NIST SP 800-171 requirements. Gaps you could previously carry on a self-assessment now have to be closed, or handled within the narrow POA&M rules (a minimum score of 88 and closeout within 180 days).
Why waiting is risky
- Remediation takes time. Policy writing, technical changes, training and evidence collection often run for months.
- Assessor capacity is limited. As more contracts require certification, C3PAO schedules fill up.
- Certification is a gate. If a solicitation requires Level 2 certification and you don't have it, you can't be awarded that contract.
What to do now
- Confirm which contracts involve CUI and which CMMC level they will require.
- Define your assessment scope, including any enclave or cloud environments.
- Run a gap assessment and calculate your current SPRS score honestly.
- Bring your System Security Plan up to date. It's the first thing an assessor reads.
- Prioritize the requirements that can't be placed on a POA&M, then work down the list.
- Plan your C3PAO assessment date backward from your next important bid.
This guide is general information based on the CMMC Program rule (32 CFR Part 170) and the DFARS CMMC clause (DFARS 252.204-7021) as of November 2026. It isn't legal advice. The requirements in your solicitation or contract always govern. Last reviewed: November 4, 2026.